Data you give us. We use this information:

• to provide you with the information, products and services that you request from us;

• to notify you about important changes regarding any of our services;

• where you do not object (or, where required by applicable law, where you consent), to send you marketing communications;

• where you apply for a job with us, in order to: (i) consider your application, including running interviews and assessments; and (ii) carry out right to work and background checks necessary to determine whether it is legal and appropriate for you to work for us.

Legal basis. We will only collect, use and share your personal data where we are satisfied that we have an appropriate legal basis to do this. The legal basis we rely upon may impact which rights you have in relation to your personal data (see “Your Rights” below for more information). The legal bases we rely upon are:

• Performance of a contract with you. This applies where you contract with us as an individual, and the processing of your personal data is necessary to provide you with the services;

• Your consent. This only applies where we have clearly obtained your consent. For example, we may obtain your consent for direct marketing purposes (although note we may also rely on our ‘legitimate interests’, where permitted to do so by law). Where we rely on your consent, you have the right to withdraw it at any time (for example, by unsubscribing from marketing, changing your mobile app settings, or otherwise contacting us);

• Legal obligation. This applies whenever we need your personal data to comply with a legal obligation, for example maintaining proper accounting records of your transactions with us, or carrying out right to work checks when you apply for a job with us. We may also be under a legal obligation to share data with courts, regulatory or other governmental agencies.

Legitimate interests. Where the above do not apply, we will have established a legitimate interest to process your personal data for a purpose described in this policy, and will ensure that our interest is not overridden by your rights and freedoms. For example, we have a legitimate intrest in:

• maintaining contact information for representatives of our corporate customers, so that we can provide our services to them and administer their accounts;

• collecting business contact information for appropriate prospective customers and sending them relevant information about services we reasonably believe may be of interest to them and their business;

• preventing account abuse and detecting possible security breaches with respect to our digital platforms.

Our approach is to only retain personal data for as long as is necessary to satisfy the relevant purpose(s) set out in this policy, subject to the following exceptions.

We will hold information required to maintain accurate company and accounting records (e.g. records of transactions) for 6 years, after which it will be destroyed.

We will continue to retain personal data where it is necessary for us to establish, exercise or defend legal claims, for example to enforce our contracts or to defend claims from or involving you.

If you apply for a job with us and are unsuccessful, we will retain your application and personal data for a period of no more than 12 months from our last communication, in order to consider you for future positions and for reporting purposes.

Where we store your data. We are a UK based company, and primarily your data will be stored and processed in the UK. However, some of our service providers store and process data outside of the UK and the European Economic Area (“EEA”), for example in Russia. Not all countries outside of the UK and EEA have equivalent data protection laws to the UK and EEA, and consequently we have taken steps to ensure that service providers who may process your personal information outside the EEA have put in place appropriate measures to protect your data, such as by entering into a standard contractual clauses approved by the EU Commission or a relevant supervisory authority. In non-routine circumstances, we may rely on a derogation available under data protection laws to transfer your personal information outside of the UK and EEA without the aforementioned measures in place. You have a right to see a copy of any agreement under which your personal information is transferred outside of the EEA, although this may be redacted for reasons of commercial sensitivity.

You have the following rights in relation to your personal data. Please note that some of these rights are dependent on our legal basis for processing your personal data, as explained above. Each right is also subject to exemptions, and we will inform you if we rely on one or more of these. Finally, when you make a request we may be required to take steps to confirm your identity.

• To be informed: the information detailed in this Privacy Policy includes everything related to how we use your data, both collected and given to us by you or any relevant third party.

• The right to access: you can request a copy of the data held and we will follow our internal procedures to provide you with the data that you request where we can, as required by law.

• To rectification: you can contact us to update or correct any of your information.

• Right to erasure: you have the right to request the erasure of your data, in certain circumstances, by law. Within your account, there are some options for you to exercise this right without contacting us.

• Right to data portability: Where our processing is based on your consent or the performance of a contract (see “Legal basis” above), you can request to obtain your personal data to reuse with another service. When you request this, we will provide this data in a commonly used format.

• Right to object or restrict: you have the right to object to our processing of your personal data that is based on legitimate interests(see “Legal basis” above), or for direct marketing purposes, and/or to restrict as you wish.

If you’d like to exercise any of these rights you can email us at hello@onecity.dev

You also have the right, at any time, to complain to your supervisory authority. In the UK this is the Information Commissioner’s Office. However, we ask that if you are unhappy you try to resolve this with us first – we will do our best to help.

Any changes we make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by email. Please check back frequently to see any changes or updates.

We welcome any questions or comments regarding this Privacy Policy. You can address them to hello@onecity.dev. Equally, if you have a complaint you can contact us at the same address and we will try our very best to rectify the situation.

Copyright NZT Ltd 2023. OneCity is the trading name of NZT Ltd, registered in England and Wales No. 9602870 with registered address at 124 City Road, London EC1V 2NX, UK.